Vulnerability Alerts

CVEs, zero-days, exploits, and security advisories

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

666 articles

VULNhighCVE-2026-502625.5 MEDIUMZero Day Initiativeabout 1 month ago

ZDI-26-396: X.Org Server ChangeDrawableAttributes Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker…

VULNhighCVE-2026-97858.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-374: Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although…

VULNhighCVE-2026-97848.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-373: Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although…

VULNhighCVE-2026-97838.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-372: Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although…

VULNhighCVE-2026-100437.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-384: MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interact…

VULNhighCVE-2026-97797.2 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-383: ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is r…

VULNhighCVE-2026-75698.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-377: Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User inter…

VULNhighCVE-2026-97878.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-376: Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although…

VULNhighCVE-2026-97868.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-375: Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although…

VULNhighCVE-2026-97828.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-371: Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although…

VULNhighCVE-2026-97818.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-370: Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although…

VULNhighCVE-2026-97808.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-369: Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User inter…

VULNhighCVE-2026-412649.8 CRITICALZero Day Initiativeabout 1 month ago

ZDI-26-364: FlowiseAI Flowise CSV Agent Prompt Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Flowise. Authentication is not r…

VULNhighCVE-2026-55887Zero Day Initiativeabout 1 month ago

ZDI-26-363: Docker MCP Plugin OCI Image Label Parsing Argument Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Docker MCP Plugin. User interact…

VULNhighCVE-2026-468737.5 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-362: Oracle VirtualBox VMSVGA Stack-based Buffer Overflow Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must…

VULNhighCVE-2026-272787.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-361: Adobe Acrobat Reader DC Field signatureInfo Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User in…

VULNhighCVE-2026-502577.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-391: X.Org Server miSyncDestroyFence Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first…

VULNhighCVE-2026-502567.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-390: X.Org Server Font Alias Stack-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first…

VULNhighCVE-2026-97738.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-386: Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is requir…

VULNhighCVE-2026-97728.8 HIGHZero Day Initiativeabout 1 month ago

ZDI-26-385: Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is requir…

VULNPalo Alto Unit 42about 1 month ago

OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat

Unit 42's analysis of ClawHub revealed evasive malicious skills bypassing automated scanners to deploy infostealers and execute ag…

VULNhighSentinelOne Labsabout 1 month ago

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer and Telegra…

VULNRecorded Futureabout 1 month ago

The Purchase Scam Tactic Headed for the World Cup | Recorded Future

A purchase scam tactic hijacks organic search through compromised sites, and it’s built to scale into 2026 FIFA World Cup fraud. H…

VULNPalo Alto Unit 42about 1 month ago

The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration

Unit 42 research details how attackers could exploit global name uniqueness in bucket hijacking to redirect cloud data streams acr…

VULNMicrosoft Securityabout 1 month ago

Guarding AI memory

What happens when threat actors target what AI remembers? Microsoft breaks down the risks and the defenses. The post Guarding AI m…

VULNCheck Point Researchabout 1 month ago

22nd June – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 22nd June, please download our Threat Intelligence Bulletin. TOP ATTA…

VULNMicrosoft Securityabout 1 month ago

One intrusion, two cyberattackers: Uncovering parallel threat activity

Ransomware case reveals two parallel threat actors, blending tactics and evasion—showing why isolated signals can often miss moder…

VULNCVE-2026-560995.3 MEDIUMFull Disclosureabout 1 month ago

OpenBSD mpls_do_error: Remote Kernel Stack Disclosure via MPLS Label Stack Over-read

Posted by shj on Jun 20 ------------------------------------------------------------------------ OpenBSD mpls_do_error: Remote Ker…

VULNFull Disclosureabout 1 month ago

OpenBSD sppp_pap_input: PAP authentication bypass

Posted by shj on Jun 20 ------------------------------------------------------------------------ OpenBSD sppp_pap_input: PAP Authe…

VULNCVE-2025-10560Full Disclosureabout 1 month ago

SEC Consult SA-20260618-0 :: Hardcoded Root Cloud Credentials in Application Binaries in Silver Leaf Technologies - Worksnaps.net Worksnaps

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 20 SEC Consult Vulnerability Lab Security Advisory ============…